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Thank you, Chairman Rush, Ranking Member Whitfield, Mr. 
Space, other members of the Subcommittee. I very much ap- 
preciate the invitation to testify, and I would like to express 
my particular gratitude for the committee's strong respect for 
free speech in the legislative process^ 

I think it would be useful to begin with a technical clarification. 
The receipt of advertising on the Web is already completely 
optional. I receive no advertisements in my browser, on my 
laptop, or on my mobile devices. Any member of the com- 
mittee or any member of the listening audience on C-SPAN 
who is using the Firefox browser could search briefly for Ad- 
Block Plus, and discover that advertising is already optional 
to receive, whether it is targeted advertising or non-targeted 
advertising^ 

The apparent connection made in the course of this discussion 
between the economics of the advertising business and whether 
surveillance ought to be authorized or acceptable on the web, 
therefore, escapes me. It is already possible for anyone wish- 
ing to receive no advertising, to do so. Yet civilization has 
not collapsed. Distinguished businesses represented here are 
still in business. I believe therefore there is no justification 
for the conclusion that legitimate control of surveillance on 

1 l am Professor of Law at Columbia Law School, where I have taught since 1987. I am the Founding 
President and Executive Director of the Software Freedom Law Center in New York, a non-profit 
corporation organized under New York law and granted federal tax exemption under section 501(c)(3) 
of the Internal Revenue Code. SFLC provides free legal advice to non-profit makers and distributors 
of free and open source software. Because of the nature of my work, I hold no stock in any information 
technology companies. I have no financial interest in the affairs of any of my clients. 

2 Since this testimony was delivered, Microsoft has announced changes in version 9 of the Inter- 
net Explorer that will implement the equivalent of AdBlock Plus in the default configuration of its 
browser. See the analysis of the privacy specialist Christopher Soghoian is response to the Microsoft 
announcement, http://paranoia.dubfire.net/2010/12/initial-thoughts-on-microsofts-ie9.html Once IE9 
is available, advertising of all kinds will no longer be received by users of almost all the major browsers 
on the market who do not want to receive them. 
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the web in the public interest would have any adverse effect 
on the economics of the web, because a blanket opt-out on 
receipt of advertising by individual consumers is already fully 
implemented and available at no charge. 

I also believe that the concept of "tracking" is perhaps part of 
the general mystification in which consumers find themselves. 
We should, I think, be more clear with consumers, who do not 
have our level of interest or expertise in these questions. We 
would be clearer with them if we simply pointed out that the 
Internet has become a very highly surveilled locale, much more 
highly surveilled than all previous social environments in their 
experience. 

As Mr. Markey pointed out earlier this afternoon in his ques- 
tioning, already half a billion people live all of their social lives 
online inside a single service provider's structure, which puts 
everything they do, everything they say to one another, ev- 
ery photograph they post, every piece of information they dis- 
tribute about their social lives in one great big database, owned 
by the single, for-profit business that Mr. Markey named. 

Facebook and similar centralized social networking services 
like to talk about their "privacy settings." This is mere de- 
ception, a simple act of deliberate confusionHI These "privacy 
settings" merely determine what one user can see of another 
user's private data. The grave, indeed fatal, design error in 
social networking services like Facebook isn't that Johnny can 
see Billy's data. It's that the service operator has uncontrolled 
access to everybody's data, regardless of the so-called "privacy 
settings.'!] 

I think we ought, therefore, to conclude that the idea of Do- 



3 A research study in submission for publication by the distinguished computer scientist Steven 
Bellovin and his group at Columbia University, generously shared with me by the author, surveyed a 
sample of Facebook users to determine their intentions with respect to privacy, and compared those 
intentions against their "privacy settings." One hundred percent of the sample were actually achieving 
something other than their intended privacy goals, with more than 90% of the sample sharing material 
they intended to keep private. A system that produces unintended, potentially harmful results for 
100% of its users is deceptive and misleading in the technical meaning of those terms. FTC requires 
no new legislative power to deal with such business practices by affirmative regulation. 

4 Facebook's published privacy policy, as of the date of filing this testimony, confirms that it has 
unrestricted access to all "information you provide to us," as well as "all information we collect when 
you interact with Facebook." See http://facebook.com/policy.php (section 2). 



Not-Track, which really ought to be described to the public 
whose interests we are protecting, as Do-Not-Surveil, is a prob- 
lem more serious and more comprehensive than the problem of 
addressing behavioral advertising, which is merely one wrin- 
kle in a rapidly changing technical environment, as others have 
noted. 

The problem we really face is the problem of identifying the ac- 
ceptable level of surveillance people are subject to in their daily 
activities, as they breathe the "online oxygen" that Mr. Markey 
referred to. At present, users of centralized social networking 
services like Facebook are comprehensively and exhaustively 
surveilled. Is this tolerable? If not, what should the limits of 
private activity against the public interest be? 

The motive of surveillance doesn't determine its acceptabil- 
ity. Whether it is for profit, or for the protection of people 
from wrongdoing of one kind or another, however valuable the 
surveillance may be to those conducting it, the public interest 
in the protection of privacy is never entirely overcome. How 
much are we prepared to abandon our traditional human un- 
derstanding that what we do when we read, when we speak to 
our friends, when we go about our social lives, is nobody's busi- 
ness except the business of the people with whom we choose 
to share? 

The purpose of surveillance targeting advertising is to collect 
information concerning the capabilities and intentions of the 
potential buyer and to affect that buyer's behavior. Oddly 
enough, those three points - collection of information about 
capabilities and intentions, for the purpose of affecting behav- 
ior is also the definition of what intelligence services do. There 
is, in fact, no practical distinction between the public activity 
we call collecting intelligence and the private activity we call 
targeting advertising. They are both spying. The purpose of 
spying has got to be one which the public would find to its 
advantage and not merely in the advantage of the institution 
performing the spying. We do that with respect to public in- 
telligence services because they are under democratic control. 



We don't do that with respect to advertising targeters: they 
are under nobody's control but their own, unless they are reg- 
ulated. 

Many technologies under present development — including tech- 
nologies developed by my client base, the client base of non- 
profit entities, who make software for everyone to share, freely 
and at no cost — would allow us to achieve the enormous bene- 
fits of the web we know now, along with many other benefits of 
the web we will have later, with minimal levels of surveillance 
instead of the maximal levels from which we presently suffer. 

That will undoubtedly bring significant economic change, as 
the web itself has brought economic change during the last 
eight thousand days, which is the total lifetime of the web so 
far. 

In the next eight thousand days, we can decide whether what 
we want is the end of social networking and all of the benefits 
of online culture, with comprehensive spying going on all the 
time, or without comprehensive spying going on all the time. 

As public servants, all of us, I think our role is to arrange to 
have as little spying as we can. 

I do not think that is an obligation we can trade off against 
any other, because I think it reaches directly to the heart of 
what I think constitutional freedom is. 

In my judgment, what we require is a comprehensive National 
Privacy Policy Act, in which Congress does what Congress 
does best - set large, general societal goals and empower all 
federal agencies in the conduct of their activities to achieve 
those goals. 

The National Environmental Policy Act has within one gener- 
ation done enormous amounts to clean our water, our air, and 
our environment because of Congress's wisdom in the declara- 
tion of broad general principles for the protection of the public 
interest. 

Privacy maintenance in the face of over-surveillance is the 



single largest environmental issue in the online world and it 
should be addressed with the same degree of seriousness and 
comprehensiveness with which the physical environment was 
addressed by Congress one generation ago. 

Businesses will naturally regard such regulation as burden- 
some. That's not a reason to refrain from acting in the public 
interest, for example, by requiring businesses to disclose fully 
to any individual on request what information they have about 
him or her and what they have so far done with it. 

Others have testified that without pervasive surveillance en- 
abling targeted advertising, small websites would founder and 
diversity and access to knowledge and opportunities for under- 
served populations would be extinguished. I see no reason to 
believe that's true. I very much doubt that there is any per- 
son in this room whose life has not been altered by Wikipedia, 
which has provided the opportunities for under-served popu- 
lations of the kinds that have been talked about: to conduct 
research and to learn at a level which is otherwise inaccessible. 
Wikipedia is unsupported by advertising and of the hundred 
most visited sites on the net studied by the Wall Street Journal 
in the series previously referred to, it was the only one of the 
one hundred not in any way surveilling or tracking its users. 
I think, once again, that the attempt to connect the adver- 
tising business model to the importance of vibrant content on 
the net, or life changing possibilities of expansion of access to 
under-served populations, is poppycock. 

In conclusion, we must have a clean environment to live in and 
we must have a clean online environment that protects our 
freedom. Our principles acknowledged, there will be plenty 
of money for everybody to earn, but without our principles 
acknowledged, we will buy our convenience with our freedom 
and that is far too high a price to pay. 

Thank you for your time. I am happy to answer your ques- 
tions. 



